- HYPE-8Negative
GoPlus Security 🚦 (@GoPlusSecurity)
⚠️ Breakdown: Papertrade BBO oracle manipulation — ~$1.28M taken 8 hours after launch On Oct 10, 2026, HyperEVM perp venue @papertrade_xyz went live, with $85.3M in pre-deposits and TVL reaching $118M within 24 hours. About 8 hours after launch it was hit by an oracle manipulation attack. Loss: ~$1.28M. This was a cross-market oracle and quote-manipulation incident. The suspected attacker first opened oversized synthetic longs and shorts on Papertrade, then used real capital to buy and sell ETH on Hyperliquid, briefly displacing Hyperliquid’s BBO mid. That displaced mid was then used for execution and PnL on Papertrade. The resulting PnL was paid by the Martingaler LP. 🔍 Root cause 1. Instant BBO from one market was the oracle Opens and closes both read the Hyperliquid best-bid/ask mid directly. The official docs explicitly state there is no max-deviation cap, no TWAP, no lookback, and no independent reference price. A non-zero, non-crossed BBO could therefore be accepted even if it had been manipulated. Papertrade’s own risk docs identified “Hyperliquid BBO manipulation” as a major protocol-level risk before launch: https://docs.papertrade.xyz/#/how/pricing-bbo 2. 1,000x leverage turned a tiny move into a large payout On hundreds of millions in notional, pushing ETH ~10–14 bps was enough to generate hundreds of thousands of dollars in Papertrade PnL. Trading loss on the external venue was far smaller than the synthetic PnL paid by the LP. 3. The per-position cap was bypassed by splitting The per-position notional cap was ~$10M. The final $297M short was split into 30 positions of ~$9.9M each, just under the limit. Directional OI controls still left ~$1B of headroom, so existing controls did not meaningfully constrain aggregate exposure in this case. 4. LP capital did not match the exposure The Martingaler LP is the sole counterparty, and its pool is largely built from trader losses. Public data showed ~$3.14M in LP against hundreds of millions in notional, up to 1,000x. Available LP capital was severely mismatched with the potential payout. 🔗 Attack flow 1. Displace the upstream BBO The suspected manipulator executed concentrated buying and selling on Hyperliquid, moving the ETH perp’s best bid and ask. Papertrade used that mid as its execution price, so the distorted BBO mid fed directly into Papertrade’s pricing. This activity occurred on HyperCore’s order book and does not map to a single HyperEVM transaction hash. 2. Open the first high-leverage positions Once the upstream BBO had shifted, the suspected manipulator submitted signed orders to the Papertrade relayer. The relayer then called the Exchange contract to open the positions. https://hyperscan.com/tx/0x199de70bc0527b0a3bec7d2c3da9d284e7e401bacd00fa75ce8e9ba5fcc40c5d The relayer appearing in the `from` field should not, by itself, be treated as the attacker. 3. Split positions to bypass the per-position cap The per-position notional cap was ~$10M. The suspected attacker split the exposure into ~30 positions of ~$9.9M each, for total exposure far above the single-position limit. Batch that appears to include ~30 shorts: https://hyperscan.com/tx/0xfad8681101614762ed5ee3dfb94feac28300f6943def595acc2f1fad91807bd3 4. Trade the other way and close in profit After the Papertrade positions were in place, the suspected manipulator traded in the opposite direction on Hyperliquid so the BBO moved in favor of those positions. With no TWAP, no max deviation, and no lookback, the distorted mid was used directly to close the positions and calculate PnL. 5. Position termination path About 30 related positions were subsequently terminated. This transaction appears to correspond to the batch termination or suspected liquidation path: https://hyperscan.com/tx/0x2a337b31c935ceb52e01ef18cc2d45248bb601d5dcecc3c42edc5c13905eb7d4 📌 Addresses Suspected attack / manipulation https://hyperevmscan.io/address/0x2025137a136bea7446deba681cbfc7cf1970840e Funds receiver / suspected coordinating address https://hyperevmscan.io/address/0x7e4e766d0ae5ea9cded0c694669194db92800107 Final suspected liquidation caller https://hyperscan.com/address/0x07626d8137ede6b922bcecf3b67f82a21100a612 Papertrade trading / settlement contract https://hyperevmscan.io/address/0x6cd5661646289fb6e65ea5c032310fded797d0a2 🛡️ Security recommendations Simply blocking the suspected attacker address does not address the root cause. 1. Stop using an instant BBO as the only settlement price. 2. Use Hyperliquid’s multi-venue weighted oracle or mark price as a reference, plus TWAP, deviation limits, and freshness checks. Official oracle docs: https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/oracle 3. Bind total OI, per-address OI, and max payable PnL to LP capital that is actually available. 4. Trigger circuit breakers on rapid long/short reversals by the same address, large trades on external markets, and anomalously high win rates.